Recovery mode of QNAP TS-41x/TS-42x devices

QNAP TS-41x/TS-42x devices have a recovery mode that can be used when there is a problem with your installation of Debian that renders your device unbootable. The system recovery mode allows you write a recovery image to flash via the network using the TFTP protocol. This pages describes how how to create recovery images and how to use the recovery mode. As an alternative to the instructions on this page, you can use a Live CD provided by QNAP.

In order to create a recovery image for your QNAP TS-41x/TS-42x, you have to take an exact copy of your flash memory. That is, the recovery image consists of the following parts of your flash in this order: mtd0, mtd4, mtd5, mtd1, mtd2, mtd3. You may wonder about this strange order but this is the way in which the data is physically stored in the flash memory. During recovery mode, mtd0 (the boot loader), mtd4 (the boot loader configuration) and on some devices mtd5 (device configuration) are ignored and the other parts of flash are overwritten with the data from your recovery image. In order to make a valid QNAP recovery image, you therefore have to put all mtd partitions into one file in the order described above.

In case your Debian system no longer boots after a system upgrade, you can use the QNAP system recovery mode to restore a previous image, an image of the Debian installer, or the QNAP firmware.

The recovery mode will first request an IP address via DHCP and then request a recovery image by TFTP from a server on your network. You have to configure your DHCP server so it will request the right file from the right machine. In particular, you have to create an entry for your QNAP that specifies filename and next-server. The latter refers to the IP address of your TFTP server (likely the same as your DHCP server). The filename of the recovery image has to start with a specific string depending on your machine (otherwise the machine won't load the image!). You also have to install a TFTP server (such as tftpd-hpa) to serve the file.

You can check the following table to find out which string to use:

Device

String

TS-410

F_TS-410

TS-412

F_TS-412

TS-410U

F_TS-410U

TS-419P

F_TS-419P

TS-419P+

F_TS-419P+

TS-419P II

F_TS-419P2+

TS-419U

F_TS-419U

TS-419U+

F_TS-419U+

TS-419U II

F_TS-419U2

TS-420

F_TS-420

TS-421

F_TS-421

One some devices (but not on the TS-419P+), you can check the backup you made of the flash to find out what the right string is for your machine:

strings mtd4 | grep bootp_vendor_class

Please note that by default the MAC address used by your QNAP device in the recovery mode is different to the one used while running the QNAP firmware. When you install Debian, a script is run to ensure that the same MAC address is used everywhere. Therefore, depending on whether you ran that script, the MAC address will either be that from the QNAP firmware (the one printed on your device; it probably starts with 00:08:9B) or an address starting with 00:50:43. You can run the recovery mode and then look for DHCPDISCOVER messages in /var/log/syslog to find out the correct MAC address.

Once you have the right MAC address, you can configure your DHCP server. I used the following entry in /etc/dhcp/dhcpd.conf:

You can activate the recovery mode by pressing the reset button on the back of your QNAP for about 10 seconds. I suggest you press the reset button and keep it pressed, and then turn on your QNAP device. After about 10 seconds, you will hear two short beeps. Your QNAP will now request a recovery image via TFTP. When it has obtained the recovery image and written it to flash (which takes about 3.5 minutes), your QNAP will make two short beeps again and restart.